Hornbook · Volume 2
Dead Reckoning · Front
Dead Reckoning
Staying in touch when the grid and the network are gone
Never burn anything indoors that was not meant to be
No grills, camping stoves, patio heaters or generators — not in the house, the garage or a porch.
Carbon monoxide has no smell. A battery alarm is the cheapest life insurance there is.
The first hour
1. Check the people, then anyone who lives alone.
2. Fill water — pots, jugs, the bath.
3. Shut the fridge and freezer and leave them shut.
4. Find the torches while you can still see.
5. Stop using phones for anything but short messages.
6. Battery or car radio for actual news.
Say this in a message
"I am safe. I am at ___. I will be in touch again at ___."
Text rather than call. Short. One group message, not six.
deadreckoning.bornbetween2generals.com
The Unseen War
Hornbook · Volume 2
Dead Reckoning · Back
Dead Reckoning
The First Hour
In order
1
Check the people. Everyone in the house, then anyone on your list who lives alone. Do this before anything else and before you investigate the outage.
2
Fill water. Before pressure drops — pots, jugs, bottles, and the bath if you have one.
3
Stop opening the fridge. Decide now what is coming out, take it out once, and then leave both doors shut.
4
Find the light. Get torches and lanterns out while you can still see to find them. This is the single most common regret.
5
Check the battery level on every phone, and stop using them for anything but messages.
6
Find out what is actually happening — a battery or hand-crank radio, or the car radio. The local AM and FM stations are the thing that works when nothing else does.
Then
Unplug sensitive electronics. The damage is often done by the surge when power returns, not by its going away.
Leave one lamp switched on so you know the moment power comes back.
If it is cold, pick one room and close it off. If it is hot, pick the lowest and shadiest room. Heating or cooling one room is possible; a house is not.
Write down the time the power went off. You will want it for the utility, for insurance, and for deciding about food.
Fill in and keep
Out-of-area contact
Their number
Where we meet nearby
Where we meet further away
Utility outage line
Radio channel, primary and alternate
Radio check times
deadreckoning.bornbetween2generals.com
The Unseen War
Hornbook · Volume 3
Backbone · Front
Backbone
Holding your ground online, when someone wants something from you
If a message makes you feel rushed, scared, or like it has to be a secret
1. Put the phone down for ninety seconds.
2. Say one line: “No.” or “I check things like this with my family first.”
3. Stop replying. Do not explain.
4. Screenshot it. Do not delete, do not block yet.
5. Tell your adult. Tonight.
You are not in trouble
Not for clicking it. Not for sending it. Not for paying it.
The only thing that makes it worse is waiting.
backbone.bornbetween2generals.com
The Unseen War
Hornbook · Volume 3
Backbone · Back
Backbone
The First Hour
Someone has images of you
1
Stop replying. Not one more message. Do not argue, do not beg, do not explain.
2
Screenshot everything — the whole conversation, their profile, their handle, the account address, any payment details. Do not delete anything and do not block them yet.
3
Do not pay. Paying never ends it. It moves you onto the list of people who pay, and the demands continue.
4
Tell an adult now. Tonight. If the person you would normally tell is not available, tell any adult you trust — a parent, a teacher, a counsellor, a coach, an aunt.
If it is happening to a friend
Believe them, and say so out loud.
Tell them it is not their fault, and that this happens to a lot of people.
Tell them not to pay and not to delete anything.
Do not pass the images on — not to check, not to help, not to anyone. Sharing them is its own offence, even with good intentions.
Go with them to an adult. Offer to be in the room. That is usually the thing that makes it possible.
Fill in and keep
My adult
Their number
Second adult
Their number
backbone.bornbetween2generals.com
The Unseen War
Hornbook · Volume 4
Deadbolt · Front
Deadbolt
The phone, the money, and the people who want both
Say this, word for word
“I do not handle money or accounts on a call I did not make.
I am hanging up now and calling back on my own number.”
Then: “What is our word?”
Never, on any call you did not make
No gift cards. No wire. No crypto. No cash to a courier.
No access to the computer.
No codes, no account numbers, no passwords.
deadbolt.bornbetween2generals.com
The Unseen War
Hornbook · Volume 4
Deadbolt · Back
Deadbolt
If It Already Happened
The calls, in order
1
Your bank or card company. Say the words “I have been defrauded” and ask for the fraud department. If a wire has just gone, ask directly for a wire recall.
2
Anyone who was impersonated. If it was a grandchild, telephone them — on your own number for them — and confirm they are fine.
3
Someone in your family. Not for permission. So that you are not carrying it alone, and so a second person can make calls while you make others.
4
The police, for a report. You will need the report number for the bank and for anything that follows.
5
Report it federally at ReportFraud.ftc.gov, and if money was taken, also at IC3.gov.
If they got into the computer
Disconnect it from the internet. Unplug the cable, or switch off the wireless.
Do not let anybody who called you “fix” it. That includes anyone who rings back offering to undo the damage — which happens, and is the same people.
Telephone your bank from a different device.
Have someone you chose look at the machine. Any installed remote-access program is removed; passwords are changed afterwards, not before.
Fill in and keep
Our word is kept
Bank fraud line
Second signature
Trusted contact
deadbolt.bornbetween2generals.com
The Unseen War
Hornbook · Volume 5
Schoolhouse · Front
Schoolhouse
What a school does in the first hour, and the week before it
Say this first
“Thank you for telling me. You are not in trouble. This happens to a lot of people, and the people who do it are criminals who do it for a living. We will deal with this together, starting now.”
Then
1. Stop the student replying.
2. The student captures the evidence. Staff do not view, copy or forward images. Ever.
3. No payment.
4. Report — NCMEC 1-800-843-5678, and law enforcement.
5. Reach the family, unless safeguarding says otherwise.
6. Stay with the student.
schoolhouse.bornbetween2generals.com
The Unseen War
Hornbook · Volume 5
Schoolhouse · Back
Schoolhouse
The First Hour
Then, in order
1
Stop the student replying. No further messages to the person, including anything conciliatory.
2
Preserve, do not browse. The student’s own device captures the screenshots — the conversation, the profile, the handle, the demand.
3
No payment. Explain plainly that paying marks the family as one that pays and the demands continue.
4
Report to NCMEC — 1-800-843-5678 or report.cybertip.org — and to law enforcement, by whatever route your district specifies.
5
Reach the family, unless your safeguarding assessment says the family is part of the risk. That exception exists and the procedure has to name it.
6
Stay with the student. The hour after a disclosure is not an hour to leave someone alone in a corridor.
Afterwards
A named person checks on the student the next day, and the week after. Put it in the calendar before the day ends.
Watch for the same account approaching other students. It usually has.
If images circulated among students, that is a separate and serious matter with its own legal weight — counsel, immediately, before anything else is decided.
Crisis support: 988, call or text.
Fill in and keep
Safeguarding lead
District contact
Law enforcement
schoolhouse.bornbetween2generals.com
The Unseen War
Hornbook · Volume 6
Shopfront · Front
Shopfront
Money leaves a small business by instruction, not by burglary
Never on an email or a text alone
No change of bank details. No change of payroll deposit. No urgent wire.
Confirm by voice, on the number we already had — never a number in the message.
Write down who you spoke to and when.
The sentence
"I can get that out today — our process on any change of details is a quick call to the number we already have on file. Two minutes."
If money has gone — today, not tomorrow
1. The bank. "I need to report a fraudulent wire and request a recall."
2. IC3.gov, in full detail.
3. Police, for a report number.
4. The insurer or broker.
5. Change the mailbox password, sign out every session, delete the forwarding rule.
Nobody is in trouble. Finding out late is the only thing that costs us.
shopfront.bornbetween2generals.com
The Unseen War
Hornbook · Volume 6
Shopfront · Back
Shopfront
The First Hour
The calls, in order
1
Your bank. Say the words "I need to report a fraudulent wire transfer and request a recall." Ask for the wire or fraud department directly. Do not email.
2
The receiving bank, if your bank gives you the name. Ask your bank to send an indemnity or recall request to them immediately.
3
Report at IC3.gov, in detail and in full. There is a federal process for attempting to freeze a fraudulent transfer, and it is initiated from that report.
4
Local police, for a report number. You will need it for insurance and the bank.
5
Your insurer or broker.
At the same time
Change the password on every mailbox involved, and sign out every active session. A password change alone does not remove someone who is already signed in.
Check the mailbox for forwarding rules and send-as permissions.
Turn on multi-factor authentication on every account, starting with email. This is the single change that stops it happening again.
Do not delete anything. The mailbox, the logs and the message are the evidence.
Telephone the real supplier on their real number and tell them. Their mailbox may be the one that was open, and other customers of theirs are being targeted right now.
Fill in and keep
Bank fraud line
Our dual-control amount
Insurer / broker
Our word
shopfront.bornbetween2generals.com
The Unseen War
Hornbook · Volume 7
Ballast · Front
Ballast
Testing whether a thing is real, now that looking at it is not enough
Forty seconds, before sharing anything
1. Notice the feeling. Strong reaction — slow down.
2. Who published it first?
3. Who else independently has it?
4. New tab — look up the source somewhere other than the source.
If you cannot answer, that is the answer. Do not share it.
Hold on to these
An image is no longer evidence that a thing happened.
A voice you recognise is not identification.
A screenshot is the weakest evidence there is.
"It could be a deepfake" is not evidence either.
A number with no denominator is not information.
Finding nothing wrong with a fake means nothing at all.
And the two hardest ones
Run the method on the things you agree with. Those are the ones you will pass on.
Never call a person a bot. Describe the pattern, not the person.
ballast.bornbetween2generals.com
The Unseen War
Hornbook · Volume 7
Ballast · Back
Ballast
Provenance
The four questions
1
What is the original? Not the account that showed it to you — the first appearance.
2
Who published it first, and are they identifiable — a named person or organisation that can be wrong in public and has something to lose?
3
When and where was it taken?
4
Who else has it? A real event of any significance has more than one witness. A single source for something enormous is the loudest signal in this book.
The image chain
Reverse image search the picture.
Search a distinctive phrase from the text in quotation marks. Fabricated quotes usually have exactly one source.
For video, search a described still from it, and look for a longer version.
Check the location against a map or street imagery when a place is claimed.
Content credentials
It is spreading, and it is not yet everywhere. Most of what you see will have no credential at all.
Credentials can be stripped, and most platforms strip them when a file is uploaded. Absence proves nothing.
Where a credential is present and intact, it is strong evidence, and far better than anything your eyes can offer.
Fill in and keep
A source I checked laterally this month
What would change my mind
Something I shared and corrected
ballast.bornbetween2generals.com
The Unseen War
Hornbook · Volume 8
Safe House · Front
Safe House
When the person who frightens you already has the keys
Keep these
National Domestic Violence Hotline — 1-800-799-7233 · text START to 88788 · thehotline.org
Emergency — 911
Crisis — 988, call or text, any time
Call
Emergency — 911
Hotline — 1-800-799-7233, or text START to 88788
Crisis — 988
The order
1. Are you safe tonight.
2. Call the hotline from a phone they cannot see.
3. Understand what they can see. Change nothing yet.
4. Make the plan with the advocate.
5. Separate in the order the plan gives.
Changing something before the plan is ready tells them you know.
safehouse.bornbetween2generals.com
The Unseen War
Hornbook · Volume 8
Safe House · Back
Safe House
Separating, When The Plan Says — keep this card where only you will see it
The order
1
A clean device and a clean account first. A phone they have never touched, a new email address made on a machine they do not know about. Everything else hangs off this.
2
Evidence before changes. Whatever you are going to need later — Part Six — is captured now, while you still have access to it.
3
The phone plan. If you are on their account, moving your number is its own project and it is visible.
4
Email and cloud, on the clean device. Change the password, then immediately check the recovery phone, recovery email, forwarding rules and connected devices.
5
Location sharing, family plans, shared calendars. These are the ones that send a notification, so they come late and together.
6
Financial accounts, then the credit freezes.
7
Trackers and devices last, physically, once you are somewhere you are not returning from — or at the moment the plan specifies.
The things people miss
Recovery email and recovery phone. The single most common way access comes back.
Forwarding rules in the email account, which quietly copy everything onward.
Devices still signed in — an old tablet, a television, a car.
Security questions whose answers they know, because they know you.
Fill in and keep
My advocate
Their number
Where I would go tonight
Who holds my copies
safehouse.bornbetween2generals.com
The Unseen War
Hornbook · Volume 9
Strongbox · Front
Strongbox
Shutting the doors on your own name
If it has already happened
1. IdentityTheft.gov — get the plan and the Identity Theft Report.
2. Freeze all the bureaus.
3. Call the fraud department where the account was opened.
4. Email password and two-factor, before anything else.
5. Police only if a company insists — the FTC report is the official one.
Keep a log of every call. That is what gets it cleared.
The afternoon, once
Freeze all seven — Equifax, Experian, TransUnion, Innovis, ChexSystems, NCTUE, LexisNexis.
Write every PIN on paper. Experian and Equifax issue none; Innovis and ChexSystems do.
Turn on the SIM lock and the port-out lock at your carrier.
Get an IRS Identity Protection PIN — anyone may have one.
Opt out of prescreened offers at optoutprescreen.com.
Freeze the children’s files, by post. Every bureau requires paper for a minor.
strongbox.bornbetween2generals.com
The Unseen War
Hornbook · Volume 9
Strongbox · Back
Strongbox
If It Has Already Happened
The first day
1
Go to IdentityTheft.gov.
2
Freeze your credit at all three major bureaus, then the four lesser-known ones in Part Two. This stops new accounts being opened while you deal with the old ones.
3
Call the fraud department of any institution where an account was opened or taken.
4
Change the password and turn on two-factor authentication on your email first, before any other account. Email is the master key — every other reset goes through it.
5
Go to the police only if a particular company insists on its own police report, or if you know something about who did it.
In the first week
Request your credit reports from all three bureaus and read them line by line. Dispute anything you do not recognise, in writing, with each bureau separately.
Place an extended fraud alert, which lasts far longer than the ordinary one and requires your Identity Theft Report.
Ask the Internal Revenue Service for an Identity Protection PIN, which stops anybody filing a tax return in your name.
Check your Social Security earnings record for employment that is not yours.
Lock your telephone number against transfer — Part Four — because if the number goes, the two-factor codes go with it.
Fill in and keep
Date frozen
Where the PINs are kept
Carrier account PIN set
Bank fraud line
strongbox.bornbetween2generals.com
The Unseen War
Hornbook · Volume 10
Meetinghouse · Front
Meetinghouse
Looking after a congregation without becoming a fortress
Say this from the front, twice a year
"Nobody in leadership here will ever ask you for gift cards, a wire, a transfer or cryptocurrency.
If you get a message like that, it is not from us. Send it to the office.
And if you already sent something — tell us. You are not in trouble."
Never, on a message alone
No money moves. No payment details change. No gift cards, ever, for anyone.
Confirm by voice, on a number you already had.
Hand to
Partner is the danger — 1-800-799-7233. Change nothing first.
Older member defrauded — the bank’s fraud line today.
Young person extorted — NCMEC 1-800-843-5678. Do not pay, do not delete.
Child at risk — the state child protection line, now.
Crisis — 988, call or text.
Emergency — 911.
meetinghouse.bornbetween2generals.com
The Unseen War
Hornbook · Volume 10
Meetinghouse · Back
Meetinghouse
The Message From The Pastor
The standing rules
No money moves on an email or a text alone. Ever. A voice on a known number, or in person.
Gift cards are never a legitimate request from anyone, for anything. No exceptions exist.
A change to any payment detail — a vendor’s bank account, a contractor’s routing number, a missionary’s transfer instructions — is confirmed by telephone on a number you already had.
Agree a word, as in Deadbolt, for any urgent request from leadership that involves money.
If someone has already sent it
1
Call the gift card company immediately with the card numbers. Occasionally the funds are still there.
2
Report at ReportFraud.ftc.gov, and at IC3.gov if money was taken.
3
Tell the congregation it happened, without naming the member. The next attempt is usually within days, to the same list.
4
Thank the member, publicly in principle and privately in person. The group that treats the first victim well is the group that hears about the second one in time.
Fill in and keep
Our two money signatures
Who holds the telephone tree
State child protection line
Our counsel
meetinghouse.bornbetween2generals.com
The Unseen War
Volume 11, The Zero-Trust Social Environment, has six cards of its own. Open them →